decision analysis for risk (and reliability) - · pdf filedecision analysis for risk (and...

Decision Analysis for Risk (and Reliability)

Basic concepts and some open problems

David Ríos Insua

[email protected]

Royal Academy of Sciences, Spain

Belgirate, May ‘11

Goals

• Provide a review of key concepts and issues in decision analysis

• Illustrate their relevance in risk analysis (and reliability analysis)

• Combine with game theory to talk about adversarial risk analysis

• Present some open problems

Outline

• Review of decision analysis• Decision analytic framework for risk analysis. • Aviation case study• Adversarial risk analysis• Some open problems

Decision Analysis

• Purpose

Support a Decision Maker in making a decision under uncertainty (consequences of decisions not known with certainty)

Risk Analysis. What is the best security resource allocation in a city?

Reliability Analysis. What is the best SW/HW maintenance policy for the ERP of a university?

DA and Risk Analysis

Risk Analysis. What is the best security resource allocation in a city?

City as a map with cellsFor each cell a valueFor each cell a forecast of delictive actsAllocate security resources (constraints)For each cell forecast impact of resource allocationOptimal resource allocation

NB: The bad guys also operate intelligent and organisedly!!!

DA and Reliabiltiy Analysis

Reliability Analysis. What is the best SW/HW maintenance policy for the ERP of a university?

Model the HW/SW system (HW and SW blocks interacting)Reliability forecast for blocksReliability forecast for systemDevice maintenance policiesForecast their impact on reliability (and consequently costs)Optimal maintenance policy

NB: Again, what about bad guys attacking our system??

Decision analysis (cycle)• Structure problem: Identify alternatives, uncertainties and

consequences

• Elicit probabilities, Possibly update in light of data

• Elicit utilities

• Compute alternative with maximum (posterior) expected utility

• Perform sensitivity analysis

• Possibly iterate, until implementation

Modelling preferences. Risk attitudes

• Under certain conditions (Von Neumann- Morgenstern axioms) model preferences and risk attitudes of a person with a utility function.

• Maximum expected utility principle

Modelling preferences. Risk attitudes

• Risk aversion. Concave utility

• Risk proneness. Convex utility

• Risk neutrality. Linear utility

• Three basic risk attitudes

Consequence varying risk attitudes

Risk attitudes

Compare lotteries A and B. Which one do you prefer?

Risk attitudes


If you prefer B to A, you seem to prefer the sure prize to the lottery (risk aversion)

In such case, the expected utility of B should be bigger than that of A:

½ * u(0) + ½ * u(100000) = ½ < 1 * u(50000)

Graphically…

Risk attitudes


If you prefer A to B, you seem to prefer the lottery to the sure prize (risk proneness)

In such case, the expected utility of A should be bigger than that of B:

½ * u(0) + ½ * u(100000) = ½ > 1 * u(50000)

Graphically…

Risk attitudes


If you are indifferent between A and B, you seem indifferent between the lottery and the sure prize (risk neutrality)

In such case, the expected utilities of A and B should be equal:

½ * u(0) + ½ * u(100000) = ½ = 1 * u(50000)

Graphically…

Which risk attitude??

•

Influence Diagrams• Tool to structure (and solve) decision making

problems• Direct acyclic graph G=(N,A)• Three main types of nodes.

– Chance. Circle– Decision. Square– Value. Hexagon, Diamond

• Fourth type of node. Deterministic. Double circle• Two types of arcs

– Arcs into decision nodes– Arcs into chance and value nodes

Influence Diagrams

Influence diagrams: Example

Influence diagrams: Multiple objectives

Bayesian computational methods

In general, we shall need to compute (posterior) maximum expected utility alternatives

Sometimes, it may be convenient to solve

One possibility, approximate expected utilities by Monte Carlothen optimise the MC sums… Sampling from the posterior??

Computational methods: Gibbs sampler

In some contexts, we are not able to sample directly from the target distribution, but we may sample from the marginal conditionals. Then, under appropriate conditions, the following scheme is designed to converge to the target distribution

Computational methods: Gibbs sampler

Imagine we need to sample from

The conditionals are easily identified and a Gibbs sampler scheme is

Computational methods: Metropolis sampler

Sometimes, we cannot sample from the conditionals. However, as we know, up to a constant, the target distribution, by choosing an appropriate candidate generating distribution q(.|.), under appropriate conditions, the following scheme is designed to converge to the target distribution

Computational methods: Augmented probability simulation

Frequently, the involved posterior depends on decision made. The following observation helps in this context. Define an artificial distribution such that (u, needs to be nonnegative)

Then, the marginal of the artificial is proportional to expected utility

This suggests the scheme

Outline


Risks in modern world

Risk management is the top prority for top management in major companies. Four years ago: human resources and talent management (Accenture report)

Demands for security in an increasingly globalised economy, pressure of regulators,

Risk analysis: What for??

Risk management for an existing or proposed facility

Development of regulationsDemonstration of compliance with

regulationsDemonstration of need for further

improvementLitigationScientific enquiry

The risk management process

1. Determination of objectivesPreserve the operating effectiveness of the organisation

2. Identification of risks3. Evaluation of risks4. Considering alternatives and selecting

the risk treatment device5. Implementing the decision6. Evaluation and review

A framework for risk analysis: starting assumptions

• Only interested in costs…

• An existing alternative

• Just my organisation is relevant

• Aim. Maximise expected utility

Risk analysis framework

• Forecast costs under normal circumstances• Identify hazard events, estimate probabilities

and impacts on costs (additional induced costs)

• Forecast costs (a “mixture” model). Compute changes in expected utility. If too big,…

• Identify interventions, estimate impact on probabilities and/or costs.

• Compute expected utilities. Choose best intervention (if gain is sufficient)

Basic setting• Design given (no interventions, status quo)• (Random) costs are identified • Expected utility computed

Basic setting• Design given

• Including design choice

Risk assessement

• Impact of risks:

• Compute expected utility after risk assessed:

• Likelihood and impact of identified hazards. They

happen with a certain probability and entail an additional cost

If impact is too high, we need to manage risks

Risk management• Intervention to be chosen:

• Gain through managed risk:

Interventions tend to reduce the likelihood of hazard appearance and its gravity… but they also entail a cost

Choose the intervention which provides the biggest gain, if it is sufficiently big…

Outline

• Introduction• Review of decision analysis• Decision analytic framework for risk analysis. • Aviation case study• Adversarial risk analysis• Some open problems

An example: Unintended slide deployment

An example from aviation operations. Background

• Safety critical in aviation industry

• Increasing competition forcing cost reduction, even more under crisis

• Relatively simple tools for risk analysis commercial aviation operations

• Unintended slide deployment under normal operations within a comercial airline

• Inflatable slides to facilitate passenger evacuation in emergency situations

• (Expected??) cost 20 million USD/year for the whole industry (IATA, 2000)


• Factors affecting incidents• Severity analysis (cost)• Risk assessment• Countermeasures?• Best countermeasure: risk management

• Estimated annual savings 600000 €

An example from aviation operations. Incident analysis

• The following potentially factors are identified

We build a logistic regression model with three explanatory variables

Relevant operational phase and personnel involved

Finally, 7 errors, 9 procedure interruptions, 19 procedure non compliances (Dirichlet model)


• Cost

– Removal cost– Transportation cost– Repair cost– Ground delay associated costs


• Removal Cost

– Lab x Tm

– Tm. Expert assesses min (30), max (60), most likely (45). Adjust triangular distribution with 0.05, 0.95 quantiles at min, max . Tri (0.385,0.75,1.115)

• Transportation cost


• Maintenance cost

• q assessed Beta (16,4)• Cm


• Costs in relation with delays


• Annual costs due to incidents

An example from aviation operations: Risk management

• Countermeasures

• Change procedure (to ‘eliminate’ interruptions and mitigate errors, pratically no cost)

• Training course to key personnel (to mitigate errors and noncompliances, practically no cost)

• Awareness campaign to key personnel through newsletters, etc… (same objective, cost 6000 euros)

• Ligt and sound warning device at each door (to mitigate errors, interruptions andnoncompliances, cost 2500 euros per door) (or only Bf)

• Visual reminders at each door (to mitigate errors adn noncompliances, cost 120 euros per door) (or only Bf)

• Note that, essentially, we only affect incident likelihood, but not incident severity

An example from aviation operations: Risk management

Outline


Adversarial risks

• Other intelligent participantsAuctions for large projects, Counterterrorism, Regulators,…

• Their actions influence my risks

• My actions influence their risks

• Some nodes might be shared…

• Possibly conflicting interests, but possibly cooperating,…

Adversarial risks: Me and other

Adversarial risks: Modelling

One-sided prescriptive support• Asymmetric prescriptive/descriptive approach (Raiffa)

– Prescriptive advice to one party conditional on a (probalistic) description of how others will behave

• A Bayesian approach (Kadane, Larkey…)– Use a SEU model for supporting the Defender– Treat the Attacker’s decision as uncertain– Help the Defender to assess probabilities of Attacker’s decisions

• Adversarial Risk Analysis– Weaken common (prior) knowledge assumption– Develop methods for the analysis of the adversaries’ thinking

to anticipate their actions. • We assume that the Attacker is a expected utility maximizer• But other models may be possible

Assessing adversary’s intelligent decisions

• Distinction between uncertainty stemming from – Nature– Intelligent adversaries’ actions

• How to assess probabilities of Attacker’s actions??• Assuming the Attacker is a SEU maximizer

– Based on an analysis of his decision problem• Assess Attacker’ probabilities and utilities • Find his action of maximum expected utility

• Uncertainty about Attacker’ decision should reflect – Defender’s uncertainty about Attacker’s probabilities and utilities

• Sources of information– Available past statistical data of Attacker’s decision behavior– Expert knowledge– Non-informative (or reference) distributions

Adversarial risks: Bayesian approach

Defend-Attack sequential model

• Two intelligent players– Defender and Attacker

• Sequential moves– First Defender, afterwards Attacker knowing Defender’s decision

( | , )Ap S d a

( , )Du d S ( , )Au a S

( | , )Dp S d a

Standard Game Theory Analysis

Nash Solution:

Expected utilities at node S

Best Attacker’s decision at node A

Assuming Defender knows Attacker’s analysis, Defender’s best decision at node D

Supporting the Defender

Defender’s problem Defender’s solution of maximum SEU

Modeling input: ??

Supporting the Defender assessing Attacker’s decision

Defender problem Defender’s view of Attacker problem

Solving the assessment problem

Defender’s view of Attacker problem

Elicitation of

A is a EU maximizer

D’s beliefs about

MC simulation

Bayesian solution for the Defend- Attack sequential model

How to avoid infinite regress?

2 2 u p G.T. (Full and common knowledge)

Asymmetric prescriptive/descriptive approach

1 1 u p

2 2ˆ ˆ u p

1 1 u p

2 2ˆ ˆ u p

1 1ˆ ˆˆ ˆ u p

Where to stop?M

1 1ˆ ˆ u p

2 2 u p

Discussion• DA vs GT

– A Bayesian prescriptive approach to support Defender against Attacker– Weaken common (prior) knowledge assumption– Analysis and assessment of Attacker’ thinking to anticipate their actions

assuming Attacker is a expected utility maximizer– Computation of her defense of maximum expected utility

• The assessment problem under infinite regress• Implementation issues

– Elicitation of a valuable judgmental input from Defender– Computational issues

Outline


Some open problems

• DA, DAD, Simultaneous, Private information. What about general structures: Two Dis, with some shared nodes?

• Role of MCMC (Augmented probability simulation)• Many unformalised criteria, very different in various fields. Could we

unify them through decision theory, decision analysis?• RA in ICT on decision theoretic footing• Modeling ICT threats based on data• Cyberinsurance• 1 vs 1. m vs n• What if the other is not EU maximiser?• Case studies: e.g Pirates in Somalia• ARA for other types of auctions

decision analysis for risk (and reliability) - · pdf filedecision analysis for risk (and...

Documents